Strangely, the event time is not consistent with the timestamp in each record. It seems the event time is always 5 hours ahead of the timestamp. I suspect I need to set the timezone explicitly? Please share some thoughts or suggestion. Thanks!
If the system parsing the events (normally the indexer, but could be a heavy forwarder) is in a different timezone than the data being indexed, then you will need to provide a TZ offset. Use a props.conf config entry of the form:
This is an index-time setting so you will have to reload previously indexed data.